ó
|
M\¬Qc
|
@ s d Z d d l Z d d l Z d d l m Z m Z m Z d d l m Z d d l m Z m Z m Z d d l m
|
Z
|
m Z m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z i d e 6d
|
e 6d e 6Z y d d l m Z e Z Wn e k
|
r,e Z n Xd e e <d d l m Z m Z m Z m! Z" d d l m# Z$ d d l% Z% d d l& Z& d Z' d e f d YZ( e e e) e e e e* e* e d Z+ d Z, d Z- d Z. d Z/ d Z0 e e d Z1 d Z2 e e d Z3 d S( s This module provides some more Pythonic support for SSL.
|
|
Object types:
|
|
SSLSocket -- subtype of socket.socket which does SSL over the socket
|
|
Exceptions:
|
|
SSLError -- exception raised for I/O errors
|
|
Functions:
|
|
cert_time_to_seconds -- convert time string used for certificate
|
notBefore and notAfter functions to integer
|
seconds past the Epoch (the time values
|
returned from time.time())
|
|
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
|
by the server running on HOST at port PORT. No
|
validation of the certificate is performed.
|
|
Integer constants:
|
|
SSL_ERROR_ZERO_RETURN
|
SSL_ERROR_WANT_READ
|
SSL_ERROR_WANT_WRITE
|
SSL_ERROR_WANT_X509_LOOKUP
|
SSL_ERROR_SYSCALL
|
SSL_ERROR_SSL
|
SSL_ERROR_WANT_CONNECT
|
|
SSL_ERROR_EOF
|
SSL_ERROR_INVALID_ERROR_CODE
|
|
The following group define certificate requirements that one side is
|
allowing/requiring from the other side:
|
|
CERT_NONE - no certificates from the other side are required (or will
|
be looked at if provided)
|
CERT_OPTIONAL - certificates are not required, but if provided will be
|
validated, and if validation fails, the connection will
|
also fail
|
CERT_REQUIRED - certificates are required, and will be validated, and
|
if validation fails, the connection will also fail
|
|
The following constants identify various SSL protocol variants:
|
|
PROTOCOL_SSLv2
|
PROTOCOL_SSLv3
|
PROTOCOL_SSLv23
|
PROTOCOL_TLSv1
|
iÿÿÿÿN( t OPENSSL_VERSION_NUMBERt OPENSSL_VERSION_INFOt OPENSSL_VERSION( t SSLError( t CERT_NONEt CERT_OPTIONALt CERT_REQUIRED( t RAND_statust RAND_egdt RAND_add( t SSL_ERROR_ZERO_RETURNt SSL_ERROR_WANT_READt SSL_ERROR_WANT_WRITEt SSL_ERROR_WANT_X509_LOOKUPt SSL_ERROR_SYSCALLt SSL_ERROR_SSLt SSL_ERROR_WANT_CONNECTt SSL_ERROR_EOFt SSL_ERROR_INVALID_ERROR_CODE( t PROTOCOL_SSLv3t PROTOCOL_SSLv23t PROTOCOL_TLSv1t TLSv1t SSLv23t SSLv3( t PROTOCOL_SSLv2t SSLv2( t sockett _fileobjectt _delegate_methodst error( t getnameinfos) DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2t SSLSocketc
|
B s e Z d Z d d e e e d e e d d Z d d Z d Z
|
e d Z d Z d d Z d d Z d d
|
Z d d d Z d d d Z d d d Z d d d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d d d Z RS( sµ This class implements a subtype of socket.socket that wraps
|
the underlying OS socket in an SSL context when necessary, and
|
provides read and write methods over that channel.c C so t j | d | j x3 t D]+ } y t | | Wq t k
|
rG q Xq W|
|
d k rm | t k rm t }
|
n | r | r | } n y t j | Wn= t
|
k
|
rÓ } | j t j k r¾ n t | _ d | _ nG Xt | _ t j | j | | | | | | |
|
| _ | r| j n | | _ | | _ | | _ | | _ | | _ |
|
| _ | | _ | | _ d | _ d S( Nt _socki ( R t __init__R! R t delattrt AttributeErrort Nonet _SSLv2_IF_EXISTSt _DEFAULT_CIPHERSt getpeernamet socket_errort errnot ENOTCONNt Falset
|
_connectedt _sslobjt Truet _sslt sslwrapt do_handshaket keyfilet certfilet cert_reqst ssl_versiont ca_certst cipherst do_handshake_on_connectt suppress_ragged_eofst _makefile_refs( t selft sockR3 R4 t server_sideR5 R6 R7 R9 R: R8 t attrt e( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyR" j sB i c C sQ y | j j | SWn6 t k
|
rL } | j d t k rF | j rF d S n Xd S( sO Read up to LEN bytes and return them.
|
Return zero-length string on EOF.i t N( R. t readR t argsR R: ( R< t lent x( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRB s c C s | j j | S( sh Write DATA to the underlying SSL channel. Returns
|
number of bytes of DATA actually transmitted.( R. t write( R< t data( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRF § s c C s | j j | S( sá Returns a formatted version of the data in the
|
certificate provided by the other end of the SSL channel.
|
Return None if no certificate was provided, {} if a
|
certificate was provided, but not validated.( R. t peer_certificate( R< t binary_form( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt getpeercert® s c C s | j s d S| j j Sd S( N( R. R% t cipher( R< ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRK · s i c C s³ | j r | d k r+ t d | j n x t r y | j j | } WnD t k
|
r } | j d t k rs d S| j d t k r d S q. X| Sq. Wn | j j
|
| | Sd S( Ni s3 non-zero flags not allowed in calls to send() on %s( R. t
|
ValueErrort __class__R/ RF R RC R R R! t send( R< RG t flagst vRE ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRN ¾ s c C sX | j r t d | j n5 | d k r> | j j | | S| j j | | | Sd S( Ns% sendto not allowed on instances of %s( R. RL RM R% R! t sendto( R< RG t flags_or_addrt addr( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRQ Ó s c C s | j rq | d k r+ t d | j n t | } d } x- | | k rl | j | | } | | 7} q@ W| St j | | | Sd S( Ni s6 non-zero flags not allowed in calls to sendall() on %s( R. RL RM RD RN R t sendall( R< RG RO t amountt countRP ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRT Ü s c C sO | j r8 | d k r+ t d | j n | j | S| j j | | Sd S( Ni s3 non-zero flags not allowed in calls to recv() on %s( R. RL RM RB R! t recv( R< t buflenRO ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRW ë s c C s¤ | r! | d k r! t | } n | d k r6 d } n | j r | d k ra t d | j n | j | } t | } | | | *| S| j j | | | Sd S( Ni i s8 non-zero flags not allowed in calls to recv_into() on %s( R% RD R. RL RM RB R! t recv_into( R< t buffert nbytesRO t
|
tmp_bufferRP ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRY õ s
|
c C s6 | j r t d | j n | j j | | Sd S( Ns' recvfrom not allowed on instances of %s( R. RL RM R! t recvfrom( R< RX RO ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyR] s c C s9 | j r t d | j n | j j | | | Sd S( Ns, recvfrom_into not allowed on instances of %s( R. RL RM R! t recvfrom_into( R< RZ R[ RO ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyR^ s c C s | j r | j j Sd Sd S( Ni ( R. t pending( R< ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyR_ s c C s? | j r% | j j } d | _ | St d t | d S( Ns No SSL wrapper around ( R. t shutdownR% RL t str( R< t s( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt unwrap s
|
c C s d | _ t j | | d S( N( R% R. R R` ( R< t how( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyR` " s c C s; | j d k r( d | _ t j | n | j d 8_ d S( Ni ( R; R% R. R t close( R< ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRe & s c C s | j j d S( s Perform a TLS/SSL handshake.N( R. R2 ( R< ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyR2 - s c C sÙ | j r t d n t j | j t | j | j | j | j | j
|
| j | _ ya | rr t j | | } n d } t j | | | s° | j r¤ | j n t | _ n | SWn t k
|
rÔ d | _ n Xd S( Ns/ attempt to connect already-connected SSLSocket!( R- RL R0 R1 R! R, R3 R4 R5 R6 R7 R8 R. R t
|
connect_exR% t connectR9 R2 R/ R) ( R< RS t return_errnot rc( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt _real_connect3 s$ c C s | j | t d S( sQ Connects to remote ADDR, and then wraps the connection in
|
an SSL channel.N( Rj R, ( R< RS ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRg J s c C s | j | t S( sQ Connects to remote ADDR, and then wraps the connection in
|
an SSL channel.( Rj R/ ( R< RS ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRf O s c C s¡ t j | \ } } yb t | d | j d | j d t d | j d | j d | j d | j d | j
|
d | j | f SWn# t k
|
r } | j | n Xd
|
S( s¿ Accepts a new connection from a remote client, and returns
|
a tuple containing that new connection wrapped with a server-side
|
SSL channel, and the address of the remote client.R3 R4 R> R5 R6 R7 R8 R9 R: N( R t acceptR R3 R4 R/ R5 R6 R7 R8 R9 R: R) Re ( R< t newsockRS R@ ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyRk T s
|
t riÿÿÿÿc C s% | j d 7_ t | | | d t S( s Make and return a file-like object that
|
works with the SSL connection. Just use the code
|
from the socket module.i Re ( R; R R/ ( R< t modet bufsize( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt makefilek s N( t __name__t
|
__module__t __doc__R% R, R R R/ R" RB RF RJ RK RN RQ RT RW RY R] R^ R_ Rc R` Re R2 Rj Rg Rf Rk Rp ( ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyR d s6 ,
|
c
|
|
C s@ t | d | d | d | d | d | d | d | d | d | S(
|
NR3 R4 R> R5 R6 R7 R9 R: R8 ( R (
|
R= R3 R4 R> R5 R6 R7 R9 R: R8 ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt wrap_socketx s c C s% d d l } | j | j | d S( s¢ Takes a date-time string in standard ASN1_print form
|
("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
|
a Python time value in seconds past the epoch.iÿÿÿÿNs %b %d %H:%M:%S %Y GMT( t timet mktimet strptime( t cert_timeRu ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt cert_time_to_seconds s s -----BEGIN CERTIFICATE-----s -----END CERTIFICATE-----c C sc t t d rB t j | } t d t j | d d t d St d t j | t d Sd S( s[ Takes a certificate in binary DER format and returns the
|
PEM version of it as a string.t standard_b64encodes
|
i@ N( t hasattrt base64Rz t
|
PEM_HEADERt textwrapt fillt
|
PEM_FOOTERt encodestring( t der_cert_bytest f( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt DER_cert_to_PEM_cert s $c C sw | j t s" t d t n | j j t sJ t d t n | j t t t t !} t j | S( sh Takes a certificate in ASCII PEM format and returns the
|
DER-encoded version of it as a byte sequences( Invalid PEM encoding; must start with %ss& Invalid PEM encoding; must end with %s( t
|
startswithR} RL t stript endswithR RD R| t decodestring( t pem_cert_stringt d( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt PEM_cert_to_DER_cert¤ s c C sx | \ } } | d k r! t } n t } t t d | d | d | } | j | | j t } | j t | S( s÷ Retrieve the certificate from the server at the specified address,
|
and return it as a PEM-encoded string.
|
If 'ca_certs' is specified, validate the server cert against it.
|
If 'ssl_version' is specified, use it in the connection attempt.R6 R5 R7 N(
|
R% R R Rt R Rg RJ R/ Re R ( RS R6 R7 t hostt portR5 Rb t dercert( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt get_server_certificate² s
|
c C s t j | d S( Ns <unknown>( t _PROTOCOL_NAMESt get( t protocol_code( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt get_protocol_nameÅ s c C sl t | d r | j } n t j | d | | t t d } y | j Wn t k
|
r] n X| j | S( s A replacement for the old socket.ssl function. Designed
|
for compability with Python 2.5 and earlier. Will disappear in
|
Python 3.0.R! i N(
|
R{ R! R0 R1 R R R% R( R) R2 ( R= R3 R4 t ssl_sock( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt sslwrap_simpleË s
|
(4 Rs R~ R0 R R R R R R R R R R R
|
R R R R R R R R R R R R R R& t ImportErrorR% R R R R R) R t _getnameinfoR| R* R' R R, R/ Rt Ry R} R R R R R R ( ( ( sK /tmp/ndk-User/buildhost/install/prebuilt/darwin-x86_64/lib/python2.7/ssl.pyt <module>8 sL @
|
|
|
|
|
" ÿ
|
